Reply To "Comment on 'Quantum String Seal Is Insecure' " 
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H. F. ChaiQ 

Department of Physics, University of Hong Kong, Pokfulam Road, Hong Kong and 
Center of Theoretical and Computational Physics, 
University of Hong Kong, Pokfulam Road, Hong Kong 
(Dated: February 2, 2008) 

In Phys. Rev. A 76, 056301 (2007), He claimed that the proof in my earlier paper [Phys. Rev. 
A 75, 012327 (2007)] is insufficient to conclude the insecurity of all quantum string seals because 
my measurement strategy cannot obtain non-trivial information on the sealed string and escape 
detection at the same time. Here, I clarify that our disagreement comes from our adoption of 
two different criteria on the minimum amount of information a quantum string seal can reveal to 
members of the public. I also point out that He did not follow my measurement strategy correctly. 

PACS numbers: 03.67.Dd, 03.67.Hk, 89.20.Ff, 89.70.+C 



In Ref. [l| , He said that the key measurement strategy 
used in my paper Q to show the insecurity of all quantum 
string seals was in the form 



Q i0 = a(u)I + b(u)\i)(i\ 



(1) 



(See Eq. (29) in Ref. Q.) He then attempted to find a 
"loophole" in my conclusion by means of two "counter- 
example" quantum string seals. 

His first scheme (Scheme A) is a family of quantum 
string seals each with a different sealed string length. 
In Scheme A, each bit in a string is independently en- 
coded as a publicly accessible state in the form cos 0i\bi) + 
sin#j|&j), where 6, is the value of the bit and < Q/n a . 
Here <C 7r/4 and a < 1/2 are two positive constants, 
and n is the bit string length. The probabilities of cor- 
rectly determining a particular bit of the string and the 
entire string are « cos 2 (0/n Q ) and ~ cos 2 ™(0/n a ), re- 
spectively [1, 3]. In other words, as n — » oo, the chance of 
correctly finding out the entire string is negligible even 
though the percentage of correctly determined bits ap- 
proaches 1. Furthermore, the number of incorrectly de- 
termined bits increases without bound in the large n 
limit. In his second scheme (Scheme B), the classical 
message i is encoded as a publicly accessible quantum 



answering the following two questions: What is the min- 
imum (classical) information a quantum string seal can 
reveal to Bob? And is He really using my measurement 
strategy reported in Ref. @ in both schemes? 

To answer the first question, let us recall that the ob- 
jective of a quantum seal is to allow detection of Bob's 
measurement with a high probability without concealing 
the sealed message Q. There are at least three possible 
ways to define what is the meaning of non-concealment 
in this context; and I list them in the order of decreasing 
ability to recover the sealed message. 

Criterion A. There is a measurement for Bob in such 
a way that the conditional entropy H con d of the 
sealed message given the measurement results is 
less than a fixed non-negative number H CTlt inde- 
pendent of the string length n. Moreover, the mu- 
tual information X between the sealed message and 
the measurement result divided by the entropy H of 
the sealed message is of the order of 1. Thus the ex- 
pected number of bits whose values are wrongly de- 
termined by Bob is finite even though Bob's chance 
of correctly determining the entire sealed string can 
be low. 



state Ej^iili)' He claimed that (the magnitudes of) Criterion B. The value H cond /H 



Ay 's should be very small (large) if the contents of the 
messages i and j were irrelevant (close) [J. In both 
schemes. He said that to follow the instructions in my 
paper [2[ , a member of the public (Bob) had to apply the 
measurement operators in the form Q^s to each encoded 
qubit. Nevertheless, this measurement strategy has little 
chance to obtain non-trivial information on the sealed 
string and escape detection simultaneously. He further 
claimed that Bob is extremely likely to be caught when 
the parameter v used in Qio approaches 1 because the 
maximum probability of correctly determining the entire 
sealed string can be made arbitrarily small by increas- 
ing n [l|. One can judge the validity of He's claim by 
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(and hence 
X/H — ► 1) in the limit of n — > oo. In other words, 
the percentage of incorrectly determined bits ap- 
proaches in the large n limit although the number 
of incorrectly determined bits may approach infin- 
ity. 

Criterion C. The value H cont ±/H < c (and hence 
X/H > 1 — c in the large n limit, where c is a fixed 
positive number of order of 1. That is, the percent- 
age of incorrectly determined bits is bounded by a 
non-zero value in the large n limit. 

Clearly, Scheme A proposed by He satisfies Criterion B 
but not Criterion A. Furthermore, independently sealing 
each bit of a classical string by an imperfect quantum bit 
seal is an example of a family of quantum seals obeying 
only Criterion C. 
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A major source of the disagreement between He and 
myself comes from the fact that I have adopted Crite- 
rion A while He used the more lenient Criterion B. I be- 
lieve that it is more natural to adopt the non-concealment 
Criterion A as the expected Hamming distance between 
the Bob's measurement result and the sealed message is 
bounded. Since most of the discussion in Ref. [2| was 
focused on sealing a fixed finite number of possible mes- 
sages N, the distinction between the above three possible 
non-concealment criteria was not clearly made there. 

Now I answer the second question: Is He using my mea- 
surement strategy reported in Ref. [2| in his analysis? As 
I have already pointed out in the second page of Ref. [2j 
that the maximum probability for Bob to correctly de- 
termine the entire sealed string can be small. Thus the 
first step in constructing the measurement strategy for a 
quantum string seal is to find a partition *|3 of the set of 
all possible sealed messages so that the maximum prob- 
ability for Bob to correctly determine which element in 
the partition does the sealed message belong to p max is 
of the order of 1. In the case of Scheme A, a possible 
choice is to partition the N = 2™ possible values of the 
sealed bit string according to the values of its first n 2a 
bits. In the large n limit, p max for this choice equals 
exp(— 6 2 ) > 0.5. In addition, such a probability can be 
attained by measuring the first n 2a qubits in the standard 
basis and keeping the remaining qubits untouched; and 
contrary to He's claim of using Qin's, my measurement 
strategy reported in Ref. [2| is to apply the measure- 
ment operators Mj(i/)'s defined by Eqs. (11) and (12) 
in Ref. [2]. It is straight-forward to check that using 
these measurement operators, Bob can obtain n 2a bits 
of information on the sealed string and escape detection 
with at least 0.5 2 = 0.25 chance simultaneously for any 
1/2 < v < 1. That is, as n — > oo, the amount of informa- 
tion on the sealed message obtained is infinite although 
the percentage of information obtained is 0. A compari- 
son of my measurement strategy on families of quantum 
seals satisfying the three different non-concealment cri- 
teria are tabulated in Table |TJ In particular, only by 
adopting Criterion A is it always possible to find a parti- 
tion *p satisfying log |5)J| < log N and p max is of the order 
of 1. 

Let me further clarify. Measurement operators Afj's 
can be applied to any quantum string seal to obtain in- 
formation with a high chance of escaping detection. In 
contrast, Q^o's in the form of Eq. (fTJ) are the measurement 
operators that maximize the average fidelity between the 
measured state and the sealed state for a special quan- 
tum string seal designed to prove Theorem 1 in Ref. |2] 
only. In fact, for a general quantum string seal, the mea- 
surement operators that maximize the average fidelity 



between the measured state and the sealed state need 
not be in the form Qio'a. One example is the (perfect) 
quantum string seal that encodes the classical message 



i as \<t>i) = Ejlo 1 ^bVVF for aU i = 0, 1, . . . , N - 1, 
where wjv is a primitive iVth root of unity. Clearly, one 
can correctly obtain the entire sealed message without 
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"Hence also the scaling of the average number of bits that can be 
extracted without being caught. 

''Hence also the scaling of the number of bits that can be extracted 
without being caught divided by the string length. 



TABLE I: Properties of families of quantum seals satisfying 
different non-concealment criteria in the limit n — > oo. 

being caught using the projective measurement opera- 
tors |</>i)(</>i|'s H Hj. Besides, these operators are not in 
the form of Eq. ([T]). This example also shows that, con- 
trary to He's claim in the security analysis of Scheme B 
[l[ , it is possible that the magnitudes of \j 's are all equal 
for all 

In conclusion, it is the adoption of different non- 
concealment criteria that causes the disagreement be- 
tween He and myself on the security of quantum string 
seals. Moreover, the issue is further complicated by He's 
misuse of (Jio' s as the measurement operator in his se- 
curity analysis. As shown in Table HI all quantum string 
seals are insecure if the non-concealment Criterion A is 
used. However, some quantum string seals are secure if 
non-concealment Criteria B or C is used in the large n 
limit. Note further that in the case of adopting Crite- 
rion C, even an honest Bob can obtain only a fraction of 
the sealed message in the large n limit. 

Finally, I remark on passing that He's claim in Ref. [l[ 
that by linearity, the operator al + f3\i)(i\ actually meant 
applying the identity operator with a certain probability 
is incorrect. This is because the state a\ip) + 0{i\ip)\i) 
does not equal a mixture of pure states and 
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